A flaw in the Weblate command‑line client (wlc) allows the program to skip SSL verification when accessing certain crafted URLs. This means an attacker can inject a malicious URL that the client will trust, potentially exposing data to a man‑in‑the‑middle attack. The vulnerability is based on a verification bypass flaw, classified as CWE‑295, and the developer has acknowledged that the client would mistakenly skip all SSL checks for these URLs.

The affected product is the Weblate command‑line client (wlc) produced by WeblateOrg. All releases prior to version 1.17.0 are vulnerable; no specific patch versions are listed beyond 1.17.0. The issue applies to any installation of wlc that processes user‑supplied URLs, regardless of the target server.

The CVSS score is 2.5, indicating a low severity. The EPSS score is below 1 %, reflecting a very low likelihood of exploitation, and the vulnerability is not listed as a known exploited vulnerability in CISA’s KEV catalog. The vulnerability can likely be exercised by any user able to run wlc with crafted URLs, meaning the attack vector is a local or remote user with access to the client’s command line. Because the flaw does not grant arbitrary code execution, the consequences are limited to enabling a man‑in‑the‑middle attack on the client’s outgoing connections.